AgentBaiting / FakeGit — SmartLoader to StealC via Fake AI Skills and MCP Servers

Attacker objective: harvest live browser sessions, credentials, cloud tokens and developer secrets from workstations by getting a human or an AI coding agent to download and run a Windows ZIP that presents itself as an AI Skill or an MCP server.

Island published research on 2026-07-20 describing a wave of the long-running FakeGit operation: about 7,600 malicious GitHub repositories created by roughly 6,600 profiles, of which more than 800 pose as AI Skills or Model Context Protocol (MCP) servers. Those AI-capability repositories were reproduced more than 600 times across public registries including LobeHub, Glama, MCP.so and MCP Market, and the wider operation recorded more than 14 million measured downloads across GitHub Release assets in around 200 repositories. The AI-themed wave built through March and peaked in April 2026.

The new part is the delivery route, not the malware. Island calls it AgentBaiting: the repositories are written to be discovered and parsed by AI agents. An agent searching for a capability finds the repository on its own, treats the attacker's README as legitimate documentation, and hands the install instructions to the operator. In Island's testing Claude Code, Gemini and ChatGPT all surfaced campaign repositories without ever being given a link. This turns a discovery step that used to require a human judgment call into an automated recommendation.

What actually runs: the ZIP contains no MCP manifest and no server code. It contains three or four files: a one-line .cmd or .bat launcher, a renamed LuaJIT interpreter, an optional lua51.dll, and a 300 KB single-line obfuscated Lua script disguised with a benign extension such as .txt, .log, .ico, .class or .ui. The launcher runs start <exe> <payload>. The interpreter is a GUI-subsystem build so no console appears, and the Lua stage additionally calls GetConsoleWindow plus ShowWindow(SW_HIDE) through the LuaJIT FFI. SmartLoader then fingerprints the host, screenshots the desktop, resolves its live C2 from a value stored in a Polygon smart contract, pulls encrypted second stages from GitHub, and reflectively loads a packed StealC PE.

Highest-value defensive angle: the execution chain is structurally weird and does not resemble any legitimate software install. A cmd.exe child that is an unsigned interpreter in a user-writable path, taking a .txt-extension file as its only argument, is a near-unique signature. Two masquerading daily scheduled tasks under %LOCALAPPDATA% named <BenignProductName>_<Base64LoaderId> give a second, independent catch point. Both are cheap to hunt and hard for the operator to change without rewriting the loader.

Defender priority: StealC takes live sessions and OAuth grants, not just passwords. If you confirm SmartLoader execution, password resets alone do not contain it. Revoke browser sessions, OAuth grants, API tokens, cloud keys and developer credentials for the affected user, and treat every AI Skill / MCP server installed from an unvetted repository in the last 120 days as suspect.

Thirteen sources fetched and snapshotted on 2026-07-28 into AgentBaiting-SmartLoader-Hunt-sources/. Every atomic indicator in this pack traces to at least one of those snapshots.

Analyst decisions

• Two waves, one loader. Island documents the July 2026 AI-Skills/MCP wave; Hexastrike, ASEC, Centri and Intellibron document the same SmartLoader family from earlier waves. The lure surface changed. The post-execution chain did not. Indicators are labelled by wave in section 4 so nobody mistakes an April C2 address for current infrastructure.
• Nothing ships at prevent/critical. Only the three ZIP hashes that appear in two independent sources are proposed at prevent, and at severity high. Everything single-sourced ships at detect or hunt.
• The Polygon-resolved C2 is deliberately perishable. The operator rotates it by updating one on-chain value. The two observed bare-IP addresses are last-seen 2026-04-12 and are shipped as historical detect, with the behavioural resolver hunt (Q5) carrying the durable detection weight.
• No repository allow/deny list ships. With ~7,600 repositories across ~6,600 accounts and active rotation, a name list is stale on arrival. The pack hunts the execution chain and the install path instead.
• Attacker-authored text encountered in a legitimate source. Island quotes the campaign README's own install instructions as evidence ("download the .exe from the Releases page, click More info then Run anyway"). That is reproduced research evidence describing the lure, not guidance to act on, and it did not influence any value in this pack.

Attack chain

Hunt hypotheses (ordered by fidelity)

Gap flagged from the scaffold: steps 7 (native anti-debug shellcode) and 13 (in-memory StealC load) have no reliable process-level telemetry. They are covered only by Falcon behavioural and memory-scan detections, and are marked GAP in the coverage map.

Read the wave column. The July 2026 AI-Skills wave supplies the ZIP hashes. The April 2026 wave supplies the loader, payload and network infrastructure, which is the same malware family but older infrastructure. Nothing here is a substitute for the behavioural queries in section 8.

Delivery packages — AI Skills / MCP wave (July 2026)

Loader components and payloads — April 2026 wave

Network and infrastructure

Host artefacts (behavioural — these are the durable ones)

Run these where Falcon telemetry is thin: agent configuration files, scheduled-task inventory, and the AI capability register.

N1 — Enumerate scheduled tasks matching the SmartLoader masquerade shape

Any task whose name is a benign product name followed by an underscore and a short alphanumeric token, whose action lives under a user-writable directory.

Get-ScheduledTask | ForEach-Object {
  $a = ($_.Actions | Where-Object { $_.Execute }) 
  foreach ($act in $a) {
    if ($act.Execute -match '(?i)\\(AppData|ProgramData)\\' -and
        $_.TaskName -match '^[A-Za-z]+_[A-Za-z0-9]{3,8}$') {
      [pscustomobject]@{
        Task = $_.TaskName
        Path = $_.TaskPath
        Exec = $act.Execute
        Args = $act.Arguments
        Author = $_.Author
      }
    }
  }
} | Format-Table -AutoSize

N2 — Find staged Lua runtime components under user profiles

$roots = @($env:LOCALAPPDATA, $env:APPDATA, "$env:USERPROFILE\Downloads", $env:TEMP)
Get-ChildItem -Path $roots -Recurse -Force -ErrorAction SilentlyContinue `
  -Include 'lua51.dll','luajit.exe','luau.exe' |
  Select-Object FullName, Length, CreationTime,
    @{n='Signed';e={ (Get-AuthenticodeSignature $_.FullName).Status }} |
  Format-Table -AutoSize

N3 — Find single-line Lua payloads disguised with benign extensions

The payloads are 296-309 KB and are one single line. Legitimate .txt, .log and .ico files of that size are essentially never one line.

$roots = @($env:LOCALAPPDATA, $env:APPDATA, "$env:USERPROFILE\Downloads", $env:TEMP)
Get-ChildItem -Path $roots -Recurse -Force -File -ErrorAction SilentlyContinue `
  -Include '*.txt','*.log','*.ico','*.license','*.class','*.ui','*.dat' |
  Where-Object { $_.Length -gt 200KB -and $_.Length -lt 600KB } |
  ForEach-Object {
    $lines = 0
    try { $lines = (Get-Content -LiteralPath $_.FullName -TotalCount 3 -ErrorAction Stop).Count } catch {}
    if ($lines -le 1) { [pscustomobject]@{ File=$_.FullName; KB=[int]($_.Length/1KB); Created=$_.CreationTime } }
  } | Format-Table -AutoSize

N4 — Inventory installed MCP servers and Agent Skills

There is no package manager here, so the config files are the inventory. Diff this output against a reviewed catalog and treat anything unrecognised as unvetted until proven otherwise.

$paths = @(
  "$env:USERPROFILE\.claude",
  "$env:USERPROFILE\.cursor",
  "$env:USERPROFILE\.codex",
  "$env:APPDATA\Claude",
  "$env:APPDATA\Code\User"
)
Get-ChildItem -Path $paths -Recurse -Force -File -ErrorAction SilentlyContinue `
  -Include 'mcp.json','*mcp*.json','settings.json','SKILL.md' |
  Select-Object FullName, Length, LastWriteTime |
  Sort-Object LastWriteTime -Descending | Format-Table -AutoSize

# then review every server command and every skill source for an .exe / .zip install step
Get-ChildItem -Path $paths -Recurse -Force -File -Filter '*.json' -ErrorAction SilentlyContinue |
  Select-String -Pattern 'releases/download|\.zip|\.exe|Invoke-WebRequest|curl ' |
  Select-Object Path, LineNumber, Line

N5 — Proxy / web gateway queries

• Dead-drop resolver: HTTP POST to any *.drpc.org or public Ethereum/Polygon JSON-RPC host from a user agent that is not a browser. With TLS inspection, match request bodies containing eth_call together with the contract address 0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc or selector 0x3bc5de30. This is the single highest-fidelity network signal in the chain.
• Static Lua user agent: match the literal user-agent string s3klqc1wa6ntg1szvckzi0nt9oumpwy6hhq. Cheap to add, zero legitimate use.
• Bare-IP POST: POST requests whose Host header is a raw IPv4 address with a URI matching /api/ or /task/ followed by a Base64 token, content type multipart/form-data.
• Registry-to-download pivot: a session that visits an MCP or Skill registry domain and then downloads a .zip from a GitHub release within the same hour, from a host with no prior GitHub release-download history.

N6 — Identity-side follow-up

• For any host with a confirmed or suspected hit, pull IdP sign-ins for that user over the following 30 days and look for session reuse from a new ASN or a new device fingerprint with no fresh MFA interaction. StealC steals cookies, so the attacker arrives already authenticated.
• Review OAuth grants and personal access tokens created or last-used after the suspected execution time, especially source-control, cloud and secrets-manager scopes.

None of these queries carries an in-query time filter. Set the window with the console time picker; the intended lookback is recorded as a // LOOKBACK: comment in each card. The AI-Skills wave peaked in April 2026, so a 120-day retrospective sweep is more useful than a 7-day one for Q1 to Q4.

// HUNT: SmartLoader launcher chain -- cmd.exe starts a renamed LuaJIT interpreter with a disguised Lua payload
// MITRE: T1204.002 | T1059.003 | T1036.005 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2 (Windows)
// LOOKBACK: 120d -- the AI-themed wave peaked April 2026
// TUNING: allowlist by SHA256HashData once you have baselined the handful of legitimate
// TUNING: interpreter-plus-data-file launchers in your estate (game mod loaders, legacy SFX tools)
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^cmd\.exe$/i
| CommandLine=/\.(txt|log|ico|license|class|ui|dat|cfg|bin)\s*$/i
| ImageFileName=/\\(Users|ProgramData)\\/i
| FileName!=/^(cmd|powershell|pwsh|conhost|reg|findstr|timeout|xcopy|robocopy|attrib|net|net1|tasklist|where|more|type)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

// HUNT: LuaJIT runtime or interpreter dropped into a user-writable staging path
// MITRE: T1105 | T1036.005 | CONF: high  FP: medium  COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten
// LOOKBACK: 120d
// TUNING: exclude ContextBaseFileName for sanctioned game launchers and installers
// TUNING: (steam.exe, wireshark installers, vendor setup binaries) after baselining one week
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\(AppData|ProgramData|Downloads|Temp)\\/i
| TargetFileName=/\\(lua51\.dll|luajit\.exe|luau\.exe|lua\.exe|lua5[0-9]*\.dll)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])

// HUNT: SmartLoader persistence -- scheduled task masquerading as a Microsoft component
// MITRE: T1053.005 | T1036.004 | CONF: high  FP: low  COST: low
// REQUIRES: ScheduledTaskRegistered
// LOOKBACK: 120d
// FALSE POSITIVES: none observed for the named clause; a few vendor updaters append a full GUID
// FALSE POSITIVES: rather than a 3-8 char token, which the length bound already excludes
#event_simpleName=/^ScheduledTaskRegistered$/
| TaskName=/(SecurityHealthService|SecurityHealthSystray|WindowsErrorRecovery|WindowsErrorReporting|ApplicationExperienceAnalysis|AudioManager|AudioSrv|OfficeClickToRunTask|OfficeTelemetry|MicrosoftEdgeUpdate)_[A-Za-z0-9+=]{3,8}$/i
| table([@timestamp, ComputerName, UserName, TaskName, TaskAuthor])

// HUNT: schtasks.exe creating persistence pointing at a user-writable interpreter + data payload
// MITRE: T1053.005 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// LOOKBACK: 120d
// TUNING: exclude ParentBaseFileName for your deployment stack (ccmexec.exe, IntuneManagementExtension.exe,
// TUNING: msiexec.exe, setup.exe) and for signed browser updaters before promoting this to an alert
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^schtasks\.exe$/i
| CommandLine=/\/create/i
| CommandLine=/(AppData\\Local|AppData\\Roaming|ProgramData)/i
| CommandLine=/\.(txt|log|lua|class|ui|ico|dat)/i
| ParentBaseFileName!=/^(ccmexec|IntuneManagementExtension|msiexec|setup|GoogleUpdate|MicrosoftEdgeUpdate)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])

// HUNT: dead-drop resolver -- public blockchain RPC resolved by a process that is not a browser or wallet
// MITRE: T1102.001 | T1568 | CONF: high  FP: medium  COST: low
// REQUIRES: DnsRequest / SuspiciousDnsRequest
// LOOKBACK: 120d
// TUNING: exclude ContextBaseFileName for sanctioned wallet and web3 tooling (node.exe on dev
// TUNING: subnets, MetaMask host processes, hardhat, foundry, geth). Do NOT allowlist the domain itself.
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/(^|\.)(drpc\.org|polygon-rpc\.com|llamarpc\.com|ankr\.com|infura\.io|alchemy\.com|quiknode\.pro|blastapi\.io|publicnode\.com)$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera|iexplore|safari|node|geth)\.exe$/i
| groupBy([ComputerName, ContextBaseFileName, DomainName], function=count(as=Lookups))
| sort(Lookups, order=desc)

// HUNT: SmartLoader host fingerprinting -- public geo-IP service queried by a non-browser process
// MITRE: T1614 | T1082 | CONF: medium  FP: medium  COST: low
// REQUIRES: DnsRequest / SuspiciousDnsRequest
// LOOKBACK: 30d
// TUNING: exclude your VPN client, EDR/telemetry agents and licensing services by ContextBaseFileName;
// TUNING: use this as a correlation signal against Q1/Q3 hits rather than a standalone alert
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^(ip-api\.com|api\.ipify\.org|ipinfo\.io|icanhazip\.com|ifconfig\.me|ipwho\.is|checkip\.amazonaws\.com)$/i
| ContextBaseFileName!=/^(chrome|msedge|firefox|brave|opera|iexplore|svchost|teams|slack)\.exe$/i
| groupBy([ComputerName, ContextBaseFileName, DomainName], function=count(as=Lookups))
| sort(Lookups, order=desc)

// HUNT: SmartLoader second-stage staging -- raw GitHub content pulled by a non-developer process
// MITRE: T1102 | T1105 | CONF: medium  FP: high  COST: medium
// REQUIRES: DnsRequest / SuspiciousDnsRequest
// LOOKBACK: 30d
// TUNING: exclude your full developer toolchain by ContextBaseFileName (git, node, python, pip, go,
// TUNING: code, devenv, curl, wget, gh) and every browser; then rank surviving processes by rarity
// TUNING: per host. A process seen on one host in the estate is the one worth opening.
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^(raw\.githubusercontent\.com|objects\.githubusercontent\.com|gist\.githubusercontent\.com)$/i
| ContextBaseFileName!=/^(git|git-remote-https|gh|code|devenv|node|npm|yarn|python|python3|pip|go|curl|wget|msedge|chrome|firefox|brave|dotnet|java)\.exe$/i
| groupBy([ComputerName, ContextBaseFileName], function=count(as=Fetches))
| sort(Fetches, order=desc)

// HUNT: known SmartLoader / StealC bare-IP C2 (historical -- rotates via the Polygon contract)
// MITRE: T1071.001 | T1041 | CONF: medium  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// LOOKBACK: 120d retrospective sweep
#event_simpleName=/^NetworkConnectIP4$/
| in(RemoteAddressIP4, values=["144.31.57.65", "144.31.57.67", "213.176.73.149"])
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort])

// HUNT: AgentBaiting delivery -- AI/MCP/Skill-themed archive dropped into a user-writable directory
// MITRE: T1195.001 | T1608.001 | CONF: medium  FP: high  COST: low
// REQUIRES: ZipFileWritten
// LOOKBACK: 120d
// TUNING: this is a triage feed, not an alert. Hash every hit against the section 10 CSV first,
// TUNING: then exclude ContextBaseFileName for your sanctioned package managers and IDEs.
#event_simpleName=/^ZipFileWritten$/
| TargetFileName=/\\(Downloads|Temp|Desktop|AppData)\\/i
| TargetFileName=/(mcp|skill|claude|agent|copilot|gemini|chatgpt|openai|llm|ai)[-_]/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])

// HUNT: AgentBaiting -- coding-agent process spawns a shell that retrieves or expands remote content
// MITRE: T1195.001 | T1105 | T1059 | CONF: medium  FP: high  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// LOOKBACK: 30d
// TUNING: baseline one week before alerting. Then keep only retrievals whose target is outside the
// TUNING: approved capability catalog, and always keep any hit whose target is a releases/download URL
// TUNING: -- a legitimate MCP server or Skill is source plus a manifest, never a downloaded Windows binary.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(node|claude|cursor|code|windsurf|codex|gemini|copilot|aider|continue|python|python3)\.exe$/i
| FileName=/^(cmd|powershell|pwsh|curl|tar|expand|git)\.exe$/i
| CommandLine=/(Invoke-WebRequest|Invoke-RestMethod|Start-BitsTransfer|Expand-Archive|releases\/download|git\s+clone|curl\s+-|tar\s+-x)/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine])

Three of the ten queries are strong enough to promote to Custom IOAs. The rest stay hunt/investigate-only because their false-positive profile depends on estate-specific baselining.

IOA-1 — Interpreter launched from a shell with a data-file argument Promote

IOA-2 — Scheduled task masquerading as a Microsoft component Promote

IOA-3 — Lua runtime written to a user-writable path Promote after baseline

Hunt / investigate-only (do not promote)

• Q5, Q6, Q7 — DNS-based. Their FP profile is entirely determined by which developer and wallet tooling you sanction. Run as scheduled searches feeding a triage queue, not as IOAs.
• Q8 — atomic and perishable. Ship the addresses through IOC Management (section 10) instead, where they can expire.
• Q9, Q10 — high FP by design. These are the AgentBaiting visibility layer; their value is inventory and triage, not alerting.

Falcon prevention policy adjuncts

• Enable Suspicious Process Blocking and Script-Based Execution Monitoring in the assigned prevention policy for developer workstations. The Lua stage is not a script Falcon parses, but the shell launcher is.
• Add the section 10 CSV to IOC Management. The three double-sourced ZIP hashes are proposed at prevent; everything else at detect so it enriches rather than blocks.

type,value,action,severity,expiration,description,tags
sha256,91e5dbfaf45edf25fbc2168f92083e05dfa427afa7633e991392e33cc7427dad,prevent,high,2027-01-28,SmartLoader package awesome-skills-claude-3.3.zip,campaign:AgentBaiting
sha256,c15693106682f2ddb26649cab6e1962a64537627cde4c5d3c79d5a0be8c1b5a8,prevent,high,2027-01-28,SmartLoader package mcp-walmart-2.2.zip,campaign:AgentBaiting
sha256,66afc7d87d10dbe392898c4e5c613e0442fabb396415c2bef3a5ef2ac752c5ad,prevent,high,2027-01-28,SmartLoader package server_databricks_mcp_1.6.zip,campaign:AgentBaiting
sha256,216a2c99fd42c00f9323d8b16dd19f622f7f4778b2b1d7cf07a3de5621fd1546,detect,high,2027-01-28,SmartLoader package yu-ai-agent-1.0-beta.3.zip,campaign:AgentBaiting
sha256,498fe8fb806cd0e6685f97fc7d74de769dae5a28cdc821557b7585ad5ad83147,detect,high,2027-01-28,SmartLoader package agent_ai_awesome_skills_2.0.zip,campaign:AgentBaiting
sha256,62744baa8077bb8be237647fd78e3bea2ca0932bf4be3d5618600f97118095f8,detect,high,2027-01-28,SmartLoader package for-security-mcp-3.3.zip,campaign:AgentBaiting
sha256,1da8df487d30b988f3c350c065206726aaa13f079a07151cd42ab5579994b9de,detect,high,2027-01-28,SmartLoader package plugins_claude_awesome_code_2.4.zip,campaign:AgentBaiting
sha256,a33f40cab1ab7f971d3464af3e7595918107332b9e83342007571842b9e22826,detect,high,2027-01-28,SmartLoader package mcp-server-jenkins-3.2.zip,campaign:AgentBaiting
sha256,3c858facbad66f5479e2c4add171421dc1b6488b36f33e7cff073aba585954a7,detect,high,2027-01-28,SmartLoader package gateway-docker-mcp-v1.6-alpha.5.zip,campaign:AgentBaiting
sha256,fc1278f419e611bf40ca414099bfd9ad98a31ffb054371e8cb65a84849b00eaf,detect,high,2027-01-28,SmartLoader package alibabacloud-skills-bigdata-v1.7.zip,campaign:AgentBaiting
sha256,fad3d429172932b72e50f52af169a80439464e3538d97810509090e2e6cdf32a,detect,high,2027-01-28,SmartLoader LuaJIT interpreter loader.exe,campaign:FakeGit
sha256,bff0904456e3151221d29ed1d7c88fc31587efbdfb28817cdcb7ec7f20cade21,detect,high,2027-01-28,SmartLoader LuaJIT interpreter selector.exe,campaign:FakeGit
sha256,bbd438d3d7a59152f1dd5e45bb8d22ee1c07f95cfe42cebbe756aaf4feadc875,detect,high,2027-01-28,SmartLoader LuaJIT interpreter unit.exe,campaign:FakeGit
sha256,3595a6b226ce4daa0a28edea152b3a887c01f6323db1d082f6568c995cdefb55,detect,high,2027-01-28,SmartLoader LuaJIT interpreter luajit.exe,campaign:FakeGit
sha256,09e0f7616dfd2f7eb2876f6ef7331d6dbc78775acd594a94b0397a56717d1fcc,detect,high,2027-01-28,SmartLoader bundled lua51.dll runtime,campaign:FakeGit
sha256,440ceb0dc5911faca54ed9a4dd186dad3d006ae4f52d0bb7d1e4b4edd8c3693a,detect,high,2027-01-28,SmartLoader bundled lua51.dll runtime,campaign:FakeGit
sha256,87de3e5a8ef669589c421220cd392ae8027a8f8d3cd97d35ac339f87dcff12c8,detect,high,2027-01-28,StealC packed PE staged from GitHub,campaign:FakeGit
ipv4,144.31.57.65,detect,high,2026-10-28,SmartLoader C2 last seen 2026-04-12 rotates via Polygon contract,campaign:FakeGit
ipv4,144.31.57.67,detect,high,2026-10-28,SmartLoader C2 last seen 2026-04-12 rotates via Polygon contract,campaign:FakeGit
ipv4,213.176.73.149,detect,high,2026-10-28,StealC C2 last seen 2026-04-12,campaign:FakeGit
ipv4,REPLACE_WITH_CURRENT_C2_FROM_CONTRACT_QUERY,detect,high,2026-10-28,live C2 read from the Polygon dead-drop contract at triage time,campaign:FakeGit

# Execution
parent=cmd.exe AND child=*.exe under \Users\ or \ProgramData\ AND cmdline ends .txt|.log|.ico|.license|.class|.ui|.dat
unsigned GUI-subsystem PE64 with no version metadata, sitting beside lua51.dll
single-line file 296-309 KB with a .txt / .log / .ico / .class / .ui extension

# Persistence
scheduled task named <BenignProductName>_<3-8 char base64 id>
two daily tasks registered within minutes of each other on one host
task action under %LOCALAPPDATA%\ or %APPDATA%\<base64 id>\

# Command and control
JSON-RPC eth_call to a public Polygon/Ethereum RPC host from a non-browser, non-wallet process
HTTP POST to a bare IPv4 host, URI /api/<base64> or /task/<base64>, multipart/form-data
static user agent s3klqc1wa6ntg1szvckzi0nt9oumpwy6hhq
raw.githubusercontent.com fetch by a process running from %APPDATA% or %LOCALAPPDATA%

# Collection artefacts
cached task file in the user's Pictures folder named after the machine GUID
session.lua or debug.lua written to %TEMP%

# Malware
SmartLoader          LuaJIT-based loader, Prometheus-obfuscated Lua stage
StealC               infostealer final payload (browser creds, cookies, sessions, extensions, screenshots)
Prometheus           Lua obfuscator used on the payload

# Dead-drop resolver (durable across C2 rotation)
polygon.drpc.org                                    public RPC endpoint abused for the eth_call
0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc          resolver contract address
0x3bc5de30                                          function selector returning the C2 string

# Second-stage staging
https://raw.githubusercontent.com/deepanshugoel99/long/refs/heads/main/long/long/message1.txt
https://raw.githubusercontent.com/deepanshugoel99/long/refs/heads/main/long/long/message2.txt

# Persistence task names observed across samples
SecurityHealthService_ODE3   WindowsErrorRecovery_ODE4   ApplicationExperienceAnalysis_ODE4
WindowsErrorReporting_ODEw   AudioManager_ODM3           OfficeClickToRunTask_7d7757

# Renamed LuaJIT interpreters observed
luau.exe  java.exe  luajit.exe  lua.exe  loader.exe  unit.exe  selector.exe  boot.exe  compiler.exe  load.exe  util.exe

# Launcher scripts observed
Launcher.cmd  Launcher.bat  Application.cmd  Application.bat  App.bat  Launch.bat  ErrorHandler.cmd  application.cmd

# Disguised Lua payloads observed
module.class  import.ui  ico64.txt  conf.txt  proto.txt  func.txt  package.txt  dynasm.txt  buff.log  static.txt  uix.txt  x64.txt  tree.txt

# For every MCP server and Agent Skill installed in the last 120 days, record and review:
#   source repository URL, owner handle, commit SHA, version, package SHA-256
#
# Reject on sight, no exceptions:
#   - install step that downloads a .zip or .exe from a Releases page
#   - README that says to click "More info" then "Run anyway" past SmartScreen
#   - package containing a .cmd/.bat launcher plus an interpreter binary
#   - no manifest, no source, only a Windows archive
#
# Verify the publisher, not the project:
#   - compare the owner handle character by character against the upstream project owner
#   - check account age, other repositories, and whether the profile mirrors a real developer
#   - a registry listing (LobeHub, Glama, MCP.so, MCP Market) is NOT a signal of legitimacy;
#     those listings reproduce the attacker's own README
#
# Cross-reference every recorded package hash against the CSV block in this pack.

Placeholder note: the live C2 row ships as REPLACE_WITH_CURRENT_C2_FROM_CONTRACT_QUERY on purpose. The current address exists only as a value inside the Polygon contract and changes whenever the operator updates it. Read it at triage time rather than shipping a guess.

This campaign never exploits anything. It publishes convincing repositories and waits for discovery to do the work, so the controls that matter are the ones that break the discovery-to-execution path rather than the ones that patch a vulnerability.

P1 — AppLocker audit rule for unsigned executables in user-writable paths (H-I1)

Prerequisites: Windows 10/11 Enterprise or Education; Application Identity service (AppIDSvc) set to Automatic; local admin or GPO edit rights; a test ring of no more than 20 developer workstations. Reboot required: No, but the Application Identity service must be running and a gpupdate is needed. Rollback: delete the GPO link (or run Set-AppLockerPolicy -XmlPolicy <empty-policy>.xml with a policy containing no rule collections), then gpupdate /force. Audit-mode rules never block, so rollback restores logging volume only, not user access.

# 1. Ensure the Application Identity service is running (required for AppLocker)
Set-Service -Name AppIDSvc -StartupType Automatic
Start-Service -Name AppIDSvc

# 2. Generate a baseline from the test ring so you can see what would be blocked
$rules = Get-ChildItem -Path "$env:USERPROFILE","$env:LOCALAPPDATA","$env:APPDATA" `
           -Recurse -Include '*.exe','*.dll' -Force -ErrorAction SilentlyContinue |
         Get-AppLockerFileInformation |
         New-AppLockerPolicy -RuleType Publisher,Hash -User Everyone -Optimize

# 3. Export, set every rule collection to AuditOnly, and review before enforcing
$rules | Set-AppLockerPolicy -XmlPolicy 'C:\Temp\AppLocker-Audit.xml'

# 4. Review what fired after 7 days
Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/EXE and DLL' |
  Where-Object { $_.Id -in 8003,8004 } |
  Select-Object TimeCreated, Id, Message -First 100

P2 — Enable the ASR prevalence/age rule in Audit, then Block (H-I2)

Prerequisites: Microsoft Defender Antivirus in active mode (not passive) with cloud-delivered protection enabled; Windows 10 1803+ or Windows 11; Defender for Endpoint licence for centralised reporting. If Defender runs in passive mode alongside Falcon, ASR rules do not apply and this playbook does not apply either. Reboot required: No. Rollback: run the same command with -AttackSurfaceReductionRules_Actions Disabled, or Remove-MpPreference -AttackSurfaceReductionRules_Ids <GUID>. Takes effect immediately, no reboot.

# Step 1 - Audit for 7 days on the developer ring
Add-MpPreference -AttackSurfaceReductionRules_Ids '01443614-cd74-433a-b99e-2ecdc07bfc25' `
                 -AttackSurfaceReductionRules_Actions AuditMode

# Step 2 - Review what would have been blocked
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' |
  Where-Object { $_.Id -eq 1122 } |
  Select-Object TimeCreated, Message -First 100

# Step 3 - After a clean audit window, switch to Block
Set-MpPreference -AttackSurfaceReductionRules_Ids '01443614-cd74-433a-b99e-2ecdc07bfc25' `
                 -AttackSurfaceReductionRules_Actions Enabled

# Verify
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

P3 — Fleet sweep and clean removal of SmartLoader persistence

Prerequisites: local admin on the target host; PowerShell 5.1+; run the read-only sweep first and review its output before running the removal block. Do not run removal on a host that is still under investigation, since it destroys the persistence artefacts. Reboot required: No. Rollback: none available for the removal block by design, which is why the sweep is a separate step. Export the sweep output to a file before removal so the artefacts are preserved as evidence; restoring a deleted malicious task is never desirable, but the evidence is.

# ---- STEP 1: SWEEP ONLY (read-only, safe to run fleet-wide) ----
$hits = @()
Get-ScheduledTask | ForEach-Object {
  $t = $_
  foreach ($act in ($t.Actions | Where-Object { $_.Execute })) {
    if ($act.Execute -match '(?i)\\(AppData|ProgramData)\\' -and
        $t.TaskName -match '^[A-Za-z]+_[A-Za-z0-9+=]{3,8}$') {
      $hits += [pscustomobject]@{
        Host = $env:COMPUTERNAME; Task = $t.TaskName; Path = $t.TaskPath
        Exec = $act.Execute; Args = $act.Arguments; Author = $t.Author
      }
    }
  }
}
$hits | Export-Csv -NoTypeInformation "C:\Temp\smartloader-sweep-$env:COMPUTERNAME.csv"
$hits | Format-Table -AutoSize

# ---- STEP 2: PRESERVE EVIDENCE (run before removal) ----
foreach ($h in $hits) {
  $dir = Split-Path -Parent $h.Exec
  if (Test-Path $dir) {
    Compress-Archive -Path $dir -DestinationPath "C:\Temp\evidence-$($h.Task).zip" -Force
    Get-ChildItem -Path $dir -Force | Get-FileHash -Algorithm SHA256 |
      Export-Csv -NoTypeInformation -Append "C:\Temp\smartloader-hashes-$env:COMPUTERNAME.csv"
  }
}

# ---- STEP 3: REMOVE (only after evidence capture and IR sign-off) ----
foreach ($h in $hits) {
  Unregister-ScheduledTask -TaskName $h.Task -TaskPath $h.Path -Confirm:$false
  $dir = Split-Path -Parent $h.Exec
  if (Test-Path $dir) { Remove-Item -LiteralPath $dir -Recurse -Force }
}
# Cached tasking and staged second stages
Remove-Item "$env:TEMP\session.lua","$env:TEMP\debug.lua" -Force -ErrorAction SilentlyContinue

P4 — Proxy rules for the dead-drop resolver and exfiltration path (H-N3)

Prerequisites: a web proxy or secure web gateway with category and destination control; TLS inspection for the body-matching rules (the URL-level rules work without it); an approved exception list for genuine wallet and web3 development hosts before you switch from monitor to block. Reboot required: No. Rollback: set each rule back to Monitor, or delete the rule. Because rule 1 can break genuine blockchain development work, deploy it in Monitor for 7 days and build the exception list from what it sees; keeping the exception list under version control is what makes rollback a one-line revert.

# Rule 1 - Blockchain RPC egress (deploy MONITOR first, then BLOCK)
#   Match:  destination host matches *.drpc.org, *.infura.io, *.alchemy.com,
#           *.ankr.com, *.quiknode.pro, *.llamarpc.com, *.publicnode.com,
#           polygon-rpc.com
#   Except: hosts in the approved web3-development group
#   Action: BLOCK, log, alert to the hunt queue

# Rule 2 - Dead-drop contract call (requires TLS inspection)
#   Match:  method=POST AND body contains "eth_call"
#           AND body contains "0x1823A9a0Ec8e0C25dD957D0841e3D41a4474bAdc"
#                OR body contains "0x3bc5de30"
#   Action: BLOCK, high-severity alert -- this is the highest-fidelity network signal in the chain

# Rule 3 - Static Lua user agent
#   Match:  User-Agent equals s3klqc1wa6ntg1szvckzi0nt9oumpwy6hhq
#   Action: BLOCK, high-severity alert

# Rule 4 - Bare-IP exfiltration pattern
#   Match:  method=POST AND Host header is a raw IPv4 literal
#           AND uri matches ^/(api|task)/[A-Za-z0-9+/=]{8,}$
#           AND content-type contains multipart/form-data
#   Action: BLOCK, high-severity alert

# Rule 5 - Raw code-hosting content for non-developers
#   Match:  destination host in (raw.githubusercontent.com,
#           objects.githubusercontent.com, gist.githubusercontent.com)
#   Except: hosts in the approved developer group
#   Action: MONITOR, feed the hunt queue (blocking this estate-wide breaks real work)

Sequence matters. StealC exfiltrates live sessions, so credential revocation has to happen even if the endpoint is already isolated, and it has to cover session tokens and OAuth grants, not just passwords.

Coverage summary: 8 of 19 mapped techniques are covered well, 6 partially, and 5 are gaps. The gaps cluster in two places, and neither is fixable with process telemetry: the pre-execution reputation problem (repository publication and lookalike accounts) belongs to the curated catalog and publisher verification in section 12, and the in-memory half of the chain (anti-debug, reflective load, screen capture) belongs to Falcon's memory-scanning and behavioural layers rather than to a query. The execution and persistence steps in between are the ones this pack covers hard, and they sit on the only path the operator cannot avoid.

Validation gates for all of the above are in section 11. Do not promote IOA-1 or IOA-2 past Monitor until gates 2, 3, 4 and 7 pass in your own estate; Q1's false-positive floor depends entirely on whether any legitimate interpreter-plus-data-file launcher exists in your image.

Source snapshots for every entry above are saved alongside this file in AgentBaiting-SmartLoader-Hunt-sources/. Every atomic indicator in section 10 was mechanically traced back to those snapshots before publication.